Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the fingerprint, but they should not be the only indicators.
One interesting fingerprint you could use is the clock skew. Since 802.11 APs typically broadcast their timestamp in beacon frames, the beacon frames provide a nice source of the devices clock skew. For more details, see "On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews".
How do you want to fingerprint access points; through OSI layer 1, 2, or above?
If you want to fingerprint them via OSI layer 3 or above, check out http://www.hping.org/; it sounds promising - but I think its' fingerprinting abilities probably do not include access points; however, I've not tried it.